CVE-2017-18918 — Improper Certificate Validation in Mattermost Mattermost-server

CWE-295 — Improper Certificate ValidationCWE-22 — Path Traversal5 documents4 sources
Severity
4.9MEDIUMNVD
EPSS
0.1%
top 73.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Mattermost Mattermost-serverMattermost Server
Timeline
PublishedJun 19
Latest updateFeb 17

Description

An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

▶NVDmattermost/mattermost_server3.6.0 — 3.6.5+1

🔴Vulnerability Details

4
OSV
Mattermost Server does not restrict SAML certificate path for System Administrators in github.com/mattermost/mattermost-server↗2026-02-17
▶
GHSA
Mattermost Server does not restrict SAML certificate path for System Administrators↗2022-05-24
▶
OSV
Mattermost Server does not restrict SAML certificate path for System Administrators↗2022-05-24
▶
CVEList
CVE-2017-18918: An issue was discovered in Mattermost Server before 3↗2020-06-19
▶
CVE-2017-18918 — Improper Certificate Validation | cvebase